Disable RC4 cipher suite For Security Vulnerability in IBM HTTP Server

Hello Everyone,

In Last blog we have seen how to disable SSLv3 for POODLE Vulnerability in IIBM HTTP Server and now today's task is disabling RC4 cipher suit in IBM HTTP Server.

The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this vulnerability to remotely expose account credentials without requiring an active man-in-the-middle session. This vulnerability is commonly referred to as "Bar Mitzvah Attack"

Resolution:

IBM recommends disabling RC4 in IBM HTTP Server. To disable RC4, complete the steps below

Procedure:

1. First You can ask IHS to print out all its known ciphers with apachectl -t -DDUMP_SSL_CIPHERS, and it will tell you each virtual hosts configuration with apachectl -t -DDUMP_SSL_CONFIG.  For that you need to go to the <WebServer_Home>/bin and run the below command.

cd /opt/IBM/HttpServer/bin
./apachectl -t -D DUMP_SSL_CIPHERS
./apachectl -t -D DUMP_SSL_CONFIG

Output:

SSL server defined at: XXXXXXXXXXXXXXXXXXXXXXXXXX
Server name: XXX
SSL enabled: YES
FIPS enabled: 0
Keyfile: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Protocols enabled: SSLV2,SSLV3,TLSv10,TLSv11,TLSv12
Ciphers for SSLV2: (defaults)
Ciphers for SSLV3: (defaults) TLS_RSA_WITH_AES_128_CBC_SHA(2F),TLS_RSA_WITH_AES_256_CBC_SHA(35b),SSL_RSA_WITH_RC4_128_SHA(35),SSL_RSA_WITH_RC4_128_MD5(34),SSL_RSA_WITH_3DES_EDE_CBC_SHA(3A)
Ciphers for TLSv10: (defaults) TLS_RSA_WITH_AES_128_CBC_SHA(2F),TLS_RSA_WITH_AES_256_CBC_SHA(35b),SSL_RSA_WITH_RC4_128_SHA(35),SSL_RSA_WITH_RC4_128_MD5(34),SSL_RSA_WITH_3DES_EDE_CBC_SHA(3A)
Ciphers for TLSv11: (defaults) TLS_RSA_WITH_AES_128_CBC_SHA(2F),TLS_RSA_WITH_AES_256_CBC_SHA(35b),SSL_RSA_WITH_RC4_128_SHA(35),SSL_RSA_WITH_RC4_128_MD5(34),SSL_RSA_WITH_3DES_EDE_CBC_SHA(3A)
Ciphers for TLSv12: (defaults) TLS_RSA_WITH_AES_128_GCM_SHA256(9C),TLS_RSA_WITH_AES_256_GCM_SHA384(9D),TLS_RSA_WITH_AES_128_CBC_SHA256(3C),TLS_RSA_WITH_AES_256_CBC_SHA256(3D),TLS_RSA_WITH_AES_128_CBC_SHA(2F),TLS_RSA_WITH_AES_256_CBC_SHA(35b),SSL_RSA_WITH_3DES_EDE_CBC_SHA(3A)

2. Find the file where you have a setting for the SSL configuration. In most of the environment it's a httpd.conf but in some cases if you are using different file you can find the file using below command.

grep -i -r "SSLEnable" /opt/IBM/HTTPServer/
/opt/IBM/HTTPServer/ is Webserver home 

3. Take backup of the configuration file e.g. httpd.conf or ssl.conf

4. Edit the configuration file to add below line after the SSLEnable section

SSLCipherSpec ALL -SSL_RSA_WITH_RC4_128_SHA -SSL_RSA_WITH_RC4_128_MD5

5. It will look like below stanza

<VirtualHost *:${HTTPD_PORT}>
SSLEnable
SSLProtocolDisable SSLv3 SSLv2
SSLCipherSpec ALL -SSL_RSA_WITH_RC4_128_SHA -SSL_RSA_WITH_RC4_128_MD5
#SSLAttributeSet 471 1
#SSLClientAuth required
</VirtualHost>

6. Restart The IBM HTTP Server

7. For final confirmation once again run step one and check the output.

Hope this will help you. Kindly comment for your suggestion and quires.  

"Effort only fully releases its reward after a person refuses to quit.”

 Regards,
 Akhilesh B. Humbe